@noy-db/hub 0.4.0-pre.0 → 0.4.0-pre.10

package/dist/{verify-26Y5GNMK.js → verify-7XWHJWUN.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-IY23KFNZ.js";
+} from "./chunk-35NMVJ7I.js";
 import {
   dualReadSealedSlot
-} from "./chunk-N6WF5PKC.js";
+} from "./chunk-NFZGZ4AK.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-HOONYZY2.js";
+} from "./chunk-AKKRXT23.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-QZWTRENR.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -137,4 +137,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-26Y5GNMK.js.map
+//# sourceMappingURL=verify-7XWHJWUN.js.map

package/dist/via/blob/active.d.ts

@@ -1,22 +1,37 @@
 /**
  * Active blob strategy factory. Calling `blobs()` returns a
- * `BlobStrategy` whose `openSlot` constructs a real `BlobSet` bound
+ * `BlobsStrategy` whose `openSlot` constructs a real `BlobSet` bound
  * to the caller's record. The returned strategy is passed into
- * `createNoydb({ blobStrategy: blobs() })` to light up the
+ * `createNoydb({ blobsStrategy: blobs() })` to light up the
  * `collection.blob(id)` path.
  *
  * This module is only reachable through the `@noy-db/hub/blobs`
  * subpath — a consumer that never imports the subpath ships none of
  * this (ESM tree-shaking + hub's `"sideEffects": false`).
  */
-import type { BlobStrategy } from '../../port/with/blob-strategy.js';
+import type { BlobsStrategy } from '../../port/with/blob-strategy.js';
+import type { BlobPinStore } from '../../with-shape/blobs/blob-pinning.js';
+/** Options for {@link withBlobs} (#808). */
+export interface WithBlobsOptions {
+    /**
+     * Device-local backend for the offline-pin registry + external side-cache
+     * (`collection.blob(id).pin()`, the `cacheBudget` LRU stamps). Default:
+     * in-memory — pins then last one app session. Supply a durable,
+     * DEVICE-LOCAL store (IndexedDB-backed on the web; it must never sync) to
+     * keep pins across restarts. See `BlobPinStore`'s doc for the posture.
+     */
+    readonly pinStore?: BlobPinStore;
+}
 /**
- * Build a default `BlobStrategy` ready to pass into `createNoydb`.
+ * Build a default `BlobsStrategy` ready to pass into `createNoydb`.
  *
  * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to
  * avoid shadowing the very common local idiom
  * `const blobs = invoices.blob(id)` in user code.
  *
+ * One `withBlobs()` instance owns one device-local pin registry + KPI
+ * counter set (#808) — treat it as "this device's" blob service.
+ *
  * @example
  * ```ts
  * import { createNoydb } from '@noy-db/hub'
@@ -24,11 +39,12 @@ import type { BlobStrategy } from '../../port/with/blob-strategy.js';
  *
  * const db = await createNoydb({
  *   store, user, secret,
- *   blobStrategy: withBlobs(),
+ *   blobsStrategy: withBlobs(),
  * })
  *
  * // Now live — delegates to BlobSet.
- * await db.vault('acme').collection('invoices').blob('inv-1').put('receipt.pdf', bytes)
+ * const vault = await db.openVault('acme')
+ * await vault.collection('invoices').blob('inv-1').put('receipt.pdf', bytes)
  * ```
  */
-export declare function withBlobs(): BlobStrategy;
+export declare function withBlobs(options?: WithBlobsOptions): BlobsStrategy;

package/dist/via/blob/binding.d.ts

@@ -45,7 +45,7 @@ import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js
  * DELIBERATELY left unwired by `compileViaBindings` (#629 Task 10, resolved
  * within parity-first — see task-10-report.md "blob purge" section):
  * `per-blob-cek.test.ts`/`forget.test.ts` prove blob-shred-on-forget is
- * gated SOLELY on the vault's `blobStrategy` being configured, never on a
+ * gated SOLELY on the vault's `blobsStrategy` being configured, never on a
  * given collection's OWN `blobFields` declaration (`.blob(id)` is callable,
  * and IS exercised by those tests, on collections with no `blobFields` at
  * all). Routing it exclusively through this binding would silently stop

package/dist/via/blob/index.d.ts

@@ -19,7 +19,11 @@
  * code should prefer this subpath so the import boundary is explicit.
  */
 export { withBlobs } from './active.js';
-export type { BlobStrategy, BlobStrategyOpenArgs } from '../../port/with/blob-strategy.js';
+export type { WithBlobsOptions } from './active.js';
+export type { BlobsStrategy, BlobsStrategyOpenArgs } from '../../port/with/blob-strategy.js';
+export { memoryBlobPinStore, blobPinKey } from '../../with-shape/blobs/blob-pinning.js';
+export type { BlobPinStore, BlobPinEntry, BlobCacheStats } from '../../with-shape/blobs/blob-pinning.js';
+export { BlobOfflineError } from '../../kernel/errors.js';
 export { memoryObjectProjection } from '../../with-shape/blobs/object-projection.js';
 export type { ObjectProjection, ObjectMeta, ObjectListEntry, PutObjectOptions, ObjectUrlOptions, PutUrlOptions, } from '../../with-shape/blobs/object-projection.js';
 export { importExternalObjects } from '../../with-shape/blobs/import-external.js';
@@ -32,3 +36,5 @@ export { runCompaction, BLOB_EVICTION_AUDIT_COLLECTION } from '../../with-shape/
 export type { BlobFieldsConfig, BlobFieldPolicy, BlobEvictionEntry, CompactRunOptions, CompactionResult, CompactionContext, } from '../../with-shape/blobs/blob-compaction.js';
 export { createExportBlobsHandle, ExportBlobsAbortedError, EXPORT_AUDIT_COLLECTION, } from '../../with-shape/blobs/export-blobs.js';
 export type { ExportBlobsOptions, ExportedBlob, ExportBlobsHandle, ExportBlobsAuditEntry, } from '../../with-shape/blobs/export-blobs.js';
+/** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
+export { NO_BLOBS } from '../../port/with/blob-strategy.js';

package/dist/via/i18n/core.d.ts

@@ -110,7 +110,7 @@ export interface I18nTextOptions {
      * the lenient `'substitute'`). The `mv` layer fires for materialized views
      * that declare `{ i18nLocale, i18nFields }` — UNION (group-key i18n fields
      * resolve before the unified-row bucketing) and query-form (resolved in
-     * `GroupedAggregation.run` before `groupAndReduce`); grouping a raw i18n field
+     * `GroupedReduction.run` before `groupAndReduce`); grouping a raw i18n field
      * without a locale throws. The `join` layer resolves a joined right-side i18n
      * field to the query locale (`toArray({ locale })` or the vault default; raw
      * when locale-less). The `export` layer fires for

package/dist/via/i18n/index.d.ts

@@ -19,3 +19,5 @@ export type { ScriptWarning } from './script.js';
 export { withI18n } from './active.js';
 export type { I18nStrategy } from './strategy.js';
 export { ReservedCollectionNameError, DictKeyMissingError, DictKeyInUseError, MissingTranslationError, LocaleNotSpecifiedError, TranslatorNotConfiguredError, ScriptViolationError, StaticDictReadonlyError, UnknownDictCodeError, } from '../../kernel/errors.js';
+/** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
+export { NO_I18N } from '../../port/with/i18n-strategy.js';

package/dist/via/money/money-reducer.d.ts

@@ -22,7 +22,7 @@
  * exactly like the generic reducers they replace.
  */
 import type { MoneyDescriptor } from './descriptor.js';
-import type { AggregateSpec } from '../../with-lookup/aggregate/aggregation.js';
+import type { ReduceSpec } from '../../with-lookup/reduce/reduction.js';
 export type FxRates = Record<string, number | string>;
 /**
  * Rewrite any `sum` / `min` / `max` reducer over a declared money field
@@ -30,4 +30,4 @@ export type FxRates = Record<string, number | string>;
  * reducers over non-money fields) pass through unchanged. Returns a new
  * spec; the input is not mutated.
  */
-export declare function wrapMoneyReducers(spec: AggregateSpec, moneyFields: Record<string, MoneyDescriptor>): AggregateSpec;
+export declare function wrapMoneyReducers(spec: ReduceSpec, moneyFields: Record<string, MoneyDescriptor>): ReduceSpec;

package/dist/walk-P5D6CF4V.js

@@ -0,0 +1,21 @@
+import {
+  dumpVaultSchema
+} from "./chunk-3V3XR4S4.js";
+import "./chunk-VYYM3MEN.js";
+import "./chunk-6ZNSB3H6.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-DMH3VZU5.js";
+import "./chunk-G2JUIDFA.js";
+import "./chunk-W3L64Y3J.js";
+import "./chunk-35NMVJ7I.js";
+import "./chunk-NFZGZ4AK.js";
+import "./chunk-QJNCB5SK.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-AKKRXT23.js";
+import "./chunk-QBAC3GXA.js";
+import "./chunk-QZWTRENR.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-P5D6CF4V.js.map

package/dist/with-audit/consent/index.d.ts

@@ -12,3 +12,5 @@ export { withConsent } from './active.js';
 export type { ConsentStrategy } from './strategy.js';
 export { CONSENT_AUDIT_COLLECTION, writeConsentEntry, loadConsentEntries, } from './consent.js';
 export type { ConsentContext, ConsentOp, ConsentAuditEntry, ConsentAuditFilter, } from './consent.js';
+/** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
+export { NO_CONSENT } from './strategy.js';

package/dist/with-audit/forget/active.d.ts

@@ -1,5 +1,5 @@
 /**
- * `withForgetCascade` — the active factory for GDPR right-to-erasure via
+ * `withForget` — the active factory for GDPR right-to-erasure via
  * per-record CEK crypto-shred. Mirrors the canonical
  * `strategy.ts` (type + `NO_FORGET` sentinel) / `active.ts` (factory) split
  * used by the other services.
@@ -22,10 +22,10 @@ import type { SubjectDeclaration, ForgetStrategy } from './strategy.js';
  * ```ts
  * createNoydb({
  *   secret, user,
- *   forgetStrategy: withForgetCascade({ subjects: { invoices: 'buyerId' } }),
+ *   forgetStrategy: withForget({ subjects: { invoices: 'buyerId' } }),
  * })
  * const result = await vault.forget('buyer-123')
  * // → { subject, recordsShredded, historyVersionsShredded, collections, … }
  * ```
  */
-export declare function withForgetCascade(opts: SubjectDeclaration): ForgetStrategy;
+export declare function withForget(opts: SubjectDeclaration): ForgetStrategy;

package/dist/with-audit/forget/index.d.ts

@@ -1,17 +1,18 @@
 /**
  * `@noy-db/hub/forget` — GDPR right-to-erasure via per-record CEK crypto-shred.
- * Import `withForgetCascade` and pass it to `createNoydb`:
+ * Import `withForget` and pass it to `createNoydb`:
  *
  * ```ts
  * import { createNoydb } from '@noy-db/hub'
- * import { withForgetCascade } from '@noy-db/hub/forget'
+ * import { withForget } from '@noy-db/hub/forget'
  *
  * const db = createNoydb({
  *   secret, user,
  *   historyStrategy: withHistory(),               // ledger for the erasure proof
- *   forgetStrategy: withForgetCascade({ subjects: { invoices: 'buyerId' } }),
+ *   forgetStrategy: withForget({ subjects: { invoices: 'buyerId' } }),
  * })
- * const result = await db.vault('main').forget('buyer-123')
+ * const vault = await db.openVault('main')
+ * const result = await vault.forget('buyer-123')
  * ```
  *
  * The erasure flow (`vault.forget`), the subject-index maintenance hooks, and
@@ -21,7 +22,7 @@
  *
  * @module
  */
-export { withForgetCascade } from './active.js';
+export { withForget } from './active.js';
 export { NO_FORGET } from './strategy.js';
 export type { SubjectDeclaration, ForgetStrategy, ForgetResult, ScopedPurgeResidueNotice, } from './strategy.js';
 export type { SubjectRef } from './subject-index.js';

package/dist/with-audit/forget/strategy.d.ts

@@ -1,5 +1,5 @@
 /**
- * `withForgetCascade` — declaration surface for GDPR right-to-erasure via
+ * `withForget` — declaration surface for GDPR right-to-erasure via
  * per-record CEK crypto-shred.
  *
  * This file holds only the *declaration* shape and the disabled sentinel.
@@ -18,12 +18,12 @@
  */
 import type { LedgerEntry } from '../../with-commit/history/ledger/entry.js';
 /**
- * User-supplied declaration passed to {@link withForgetCascade}. Maps a
+ * User-supplied declaration passed to {@link withForget}. Maps a
  * collection name to the record field (dotted path supported, e.g.
  * `'billing.buyerId'`) that identifies the data subject for erasure.
  *
  * ```ts
- * withForgetCascade({ subjects: { invoices: 'buyerId', contacts: 'id' } })
+ * withForget({ subjects: { invoices: 'buyerId', contacts: 'id' } })
  * ```
  */
 export interface SubjectDeclaration {

package/dist/with-audit/guards/executor.d.ts

@@ -1,6 +1,6 @@
-import type { GuardStrategy, GuardContext, GuardChange } from './types.js';
+import type { GuardSpec, GuardContext, GuardChange } from './types.js';
 /**
- * Pure functions that execute the work declared by a `GuardStrategy`.
+ * Pure functions that execute the work declared by a `GuardSpec`.
  * Stateless — `GuardRegistry` decides when to call these.
  *
  * @internal
@@ -17,10 +17,10 @@ export declare const GuardExecutor: {
      *   `existing[field]` vs `incoming[field]` would always look like a
      *   change even when the computed result is unchanged.
      */
-    checkFrozenFields<T extends Record<string, unknown>>(guard: GuardStrategy<T>, id: string, existing: T | null, incoming: T, skipFields?: ReadonlySet<string>): Promise<void>;
+    checkFrozenFields<T extends Record<string, unknown>>(guard: GuardSpec<T>, id: string, existing: T | null, incoming: T, skipFields?: ReadonlySet<string>): Promise<void>;
     /**
      * Run a single guard's invariant over its slice of the change-set.
      * Any throw is converted to `InvariantError` unless it already is one.
      */
-    runInvariant<T extends Record<string, unknown>>(guard: GuardStrategy<T>, changes: ReadonlyArray<GuardChange<T>>, ctx: GuardContext<T>): Promise<void>;
+    runInvariant<T extends Record<string, unknown>>(guard: GuardSpec<T>, changes: ReadonlyArray<GuardChange<T>>, ctx: GuardContext<T>): Promise<void>;
 };

package/dist/with-audit/guards/immutable-guard.d.ts

@@ -25,7 +25,7 @@
  * ledgered by the guard amendment mechanism). `appendOnly: true` is
  * shorthand for `after: () => true` — immutable from creation.
  */
-import type { GuardStrategyHandle, GuardContext, GuardChange } from './types.js';
+import type { GuardStrategy, GuardContext, GuardChange } from './types.js';
 export interface ImmutableGuardConfig<T extends Record<string, unknown>> {
     /** The collection to make WORM. */
     collection: string;
@@ -42,7 +42,7 @@ export interface ImmutableGuardConfig<T extends Record<string, unknown>> {
     amendmentRoles?: ReadonlyArray<'admin' | 'owner'>;
     /**
      * Optional set-level invariant run over the amendment change-set after
-     * the writes execute. Signature matches `GuardStrategy.amendment.invariant`
+     * the writes execute. Signature matches `GuardSpec.amendment.invariant`
      * exactly: it receives every {before, after} pair touching this
      * collection in the amendment plus the guard context; throwing reverts
      * the whole amendment and surfaces as `InvariantError`.
@@ -60,4 +60,4 @@ export interface ImmutableGuardConfig<T extends Record<string, unknown>> {
  * Build an immutability guard. Pass the returned handle to
  * `createNoydb({ guardStrategies: [...] })`.
  */
-export declare function immutableGuard<T extends Record<string, unknown>>(config: ImmutableGuardConfig<T>): GuardStrategyHandle<T>;
+export declare function immutableGuard<T extends Record<string, unknown>>(config: ImmutableGuardConfig<T>): GuardStrategy<T>;

package/dist/with-audit/guards/index.d.ts

@@ -6,5 +6,5 @@ export type { TransitionGuardConfig } from './transition-guard.js';
 export { GuardRegistry } from './registry.js';
 export { GuardExecutor } from './executor.js';
 export { ReadOnlyVaultFacade } from './read-only-facade.js';
-export type { GuardStrategy, GuardStrategyHandle, GuardContext, GuardChange, } from './types.js';
+export type { GuardSpec, GuardStrategy, GuardContext, GuardChange, } from './types.js';
 export { RecordLockedError, FieldFrozenError, IllegalTransitionError, InvariantError, AmendmentForbiddenError, } from '../../kernel/errors.js';

package/dist/with-audit/guards/registry.d.ts

@@ -1,4 +1,4 @@
-import type { GuardStrategy, GuardContext, GuardChange } from './types.js';
+import type { GuardSpec, GuardContext, GuardChange } from './types.js';
 /**
  * Per-record metadata attached to every entry in an amendment's
  * change-set. Carried in a parallel map alongside `_amendmentChanges`
@@ -20,14 +20,14 @@ export interface AmendmentChangeMeta {
  *
  * @internal
  */
-type AnyGuard = GuardStrategy<Record<string, unknown>>;
+type AnyGuard = GuardSpec<Record<string, unknown>>;
 type AnyChange = GuardChange<Record<string, unknown>>;
 export declare class GuardRegistry {
     private readonly _byCollection;
     private _amendmentChanges;
     private _amendmentMeta;
     /** Register a guard. Multiple guards per collection are allowed. */
-    register<T extends Record<string, unknown>>(spec: GuardStrategy<T>): void;
+    register<T extends Record<string, unknown>>(spec: GuardSpec<T>): void;
     /** All guards registered against `collection` in registration order. */
     guardsFor(collection: string): ReadonlyArray<AnyGuard>;
     /** Per-collection guard counts, for introspection. */

package/dist/with-audit/guards/transition-guard.d.ts

@@ -42,7 +42,7 @@
  *
  * The status graph is caller-supplied data — no UI, no domain logic.
  */
-import type { GuardStrategyHandle, GuardContext, GuardChange } from './types.js';
+import type { GuardStrategy, GuardContext, GuardChange } from './types.js';
 export interface TransitionGuardConfig<T extends Record<string, unknown>> {
     /** The collection whose state field is governed. */
     collection: string;
@@ -68,7 +68,7 @@ export interface TransitionGuardConfig<T extends Record<string, unknown>> {
     amendmentRoles?: ReadonlyArray<'admin' | 'owner'>;
     /**
      * Optional set-level invariant run over the amendment change-set after
-     * the writes execute. Signature matches `GuardStrategy.amendment.invariant`
+     * the writes execute. Signature matches `GuardSpec.amendment.invariant`
      * exactly. When omitted the amendment is unconditionally allowed (the
      * amendment itself is the sanctioned, ledgered override) — the
      * backward-compatible default. Mirrors {@link immutableGuard}.
@@ -79,4 +79,4 @@ export interface TransitionGuardConfig<T extends Record<string, unknown>> {
  * Build a state-machine transition guard. Pass the returned handle to
  * `createNoydb({ guardStrategies: [...] })`.
  */
-export declare function transitionGuard<T extends Record<string, unknown>>(config: TransitionGuardConfig<T>): GuardStrategyHandle<T>;
+export declare function transitionGuard<T extends Record<string, unknown>>(config: TransitionGuardConfig<T>): GuardStrategy<T>;

package/dist/with-audit/guards/types.d.ts

@@ -36,16 +36,16 @@ export interface GuardChange<T> {
     after: T;
 }
 /** @internal — output of {@link withGuard}. */
-export interface GuardStrategyHandle<T extends Record<string, unknown>> {
+export interface GuardStrategy<T extends Record<string, unknown>> {
     readonly __noydb_strategy: 'guard';
-    readonly spec: GuardStrategy<T>;
+    readonly spec: GuardSpec<T>;
 }
 /**
- * Existential erasure of `GuardStrategyHandle<T>` — used as the
+ * Existential erasure of `GuardStrategy<T>` — used as the
  * element type of `ReadonlyArray<>` fields where the per-handle T
  * differs (e.g. `guardStrategies: [invoiceGuard, disbursementGuard]`).
  *
- * Background: `GuardStrategyHandle<T>` is INVARIANT in T because T
+ * Background: `GuardStrategy<T>` is INVARIANT in T because T
  * appears in callback positions on the spec (`check(incoming: T, ctx)`,
  * `invariant(changes: ReadonlyArray<GuardChange<T>>, ctx)`). So
  * `Handle<Invoice>` is not assignable to `Handle<Record<string, unknown>>`.
@@ -55,9 +55,9 @@ export interface GuardStrategyHandle<T extends Record<string, unknown>> {
  * interface that ERASES T from both the discriminant and the spec.
  *
  * Consumers continue to construct typed handles via `withGuard<T>(...)`
- * which returns `GuardStrategyHandle<T>`. Both `Handle<Invoice>` and
- * `Handle<Disbursement>` structurally assign to `GuardStrategyHandleAny`,
- * so an array of them is `GuardStrategyHandleAny[]`.
+ * which returns `GuardStrategy<T>`. Both `Handle<Invoice>` and
+ * `Handle<Disbursement>` structurally assign to `GuardStrategyAny`,
+ * so an array of them is `GuardStrategyAny[]`.
  *
  * Internal code that needs T re-narrows via the runtime discriminant
  * (`__noydb_strategy === 'guard'`) plus per-handle type information
@@ -69,12 +69,12 @@ export interface GuardStrategyHandle<T extends Record<string, unknown>> {
  *
  * @internal
  */
-export interface GuardStrategyHandleAny {
+export interface GuardStrategyAny {
     readonly __noydb_strategy: 'guard';
-    readonly spec: GuardStrategy<any>;
+    readonly spec: GuardSpec<any>;
 }
 /** Public registration shape. See `withGuard()`. */
-export interface GuardStrategy<T extends Record<string, unknown>> {
+export interface GuardSpec<T extends Record<string, unknown>> {
     collection: string;
     /**
      * Fires on `Collection.put` (insert + update). The `incoming` argument

package/dist/with-audit/guards/with-guard.d.ts

@@ -1,4 +1,4 @@
-import type { GuardStrategy, GuardStrategyHandle } from './types.js';
+import type { GuardSpec, GuardStrategy } from './types.js';
 /**
  * Register a guard for a collection. Guards run on every `put()` /
  * `delete()` for the named collection (after permissions, before
@@ -12,4 +12,4 @@ import type { GuardStrategy, GuardStrategyHandle } from './types.js';
  *
  * @see docs/superpowers/specs/2026-05-18-guards-design.md
  */
-export declare function withGuard<T extends Record<string, unknown>>(strategy: GuardStrategy<T>): GuardStrategyHandle<T>;
+export declare function withGuard<T extends Record<string, unknown>>(strategy: GuardSpec<T>): GuardStrategy<T>;

package/dist/with-audit/periods/index.d.ts

@@ -16,3 +16,5 @@ export { withPeriods } from './active.js';
 export type { PeriodsStrategy } from './strategy.js';
 export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, periodExclusiveUpperBound, loadPeriods, chainAnchor, assertTsWritable, validatePeriodName, appendPeriodLedgerEntry, } from './periods.js';
 export type { PeriodRecord, PeriodFreezeRecord, PeriodArchiveRecord, PeriodTargetPurgeRecord, TargetPurgeCount, ClosePeriodOptions, OpenPeriodOptions, CarryForwardContext, ReadOnlyCollection, } from './periods.js';
+/** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
+export { NO_PERIODS } from './strategy.js';

package/dist/with-audit/periods/periods.d.ts

@@ -146,14 +146,7 @@
  */
 import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js';
 import type { LedgerStore } from '../../with-commit/history/ledger/index.js';
-/** The reserved collection name holding closed-period metadata. */
-export declare const PERIODS_COLLECTION = "_periods";
-/** Sibling of {@link PERIODS_COLLECTION} holding freeze companions (#604). */
-export declare const PERIOD_FREEZES_COLLECTION = "_period_freezes";
-/** Sibling of {@link PERIODS_COLLECTION} holding archive companions (#613). */
-export declare const PERIOD_ARCHIVES_COLLECTION = "_period_archives";
-/** Sibling of {@link PERIODS_COLLECTION} holding target-purge companions (#615). */
-export declare const PERIOD_TARGET_PURGES_COLLECTION = "_period_target_purges";
+export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, periodExclusiveUpperBound, } from './window.js';
 /**
  * Companion record recording that a closed period was frozen (its delete
  * markers physically purged). Stored in {@link PERIOD_FREEZES_COLLECTION},
@@ -196,14 +189,6 @@ export interface PeriodTargetPurgeRecord {
     readonly purgedBy: string;
     readonly targets: readonly TargetPurgeCount[];
 }
-/**
- * Exclusive upper bound for a period's delete-marker purge window (#604).
- * Markers carry no business date (empty body), only write-time `_ts`, so freeze
- * purges markers with `_ts < bound`, `bound` being the instant just after the
- * period's inclusive `endDate`: a date-only `endDate` seals through end-of-day
- * → next midnight; a full-timestamp `endDate` seals through that instant → +1ms.
- */
-export declare function periodExclusiveUpperBound(endDate: string): string;
 /**
  * Stored record for one closed or opened accounting period. One entry
  * per period, keyed by `name` in the reserved `_periods` collection.

package/dist/with-audit/periods/vault-facade.d.ts

@@ -28,6 +28,12 @@ export interface VaultPeriodsDeps {
     archiveRecords(before: string): Promise<number>;
     /** #615: sweep delete markers off the vault's push-only sync targets. Bound to `vault._purgePeriodTargets`. */
     purgeTargets(before: string): Promise<readonly TargetPurgeCount[]>;
+    /**
+     * #822: mark a reserved-collection write dirty so the sync engine pushes
+     * it. Bound to the vault's `onDirty` when sync is configured, `undefined`
+     * otherwise. Only `_periods` uses it — see `writeReserved`.
+     */
+    onDirty?: ((collection: string, id: string, action: 'put', version: number) => Promise<void>) | undefined;
 }
 export declare class VaultPeriods {
     private readonly deps;

package/dist/with-audit/periods/window.d.ts

@@ -0,0 +1,16 @@
+/** The reserved collection name holding closed-period metadata. */
+export declare const PERIODS_COLLECTION = "_periods";
+/** Sibling of {@link PERIODS_COLLECTION} holding freeze companions (#604). */
+export declare const PERIOD_FREEZES_COLLECTION = "_period_freezes";
+/** Sibling of {@link PERIODS_COLLECTION} holding archive companions (#613). */
+export declare const PERIOD_ARCHIVES_COLLECTION = "_period_archives";
+/** Sibling of {@link PERIODS_COLLECTION} holding target-purge companions (#615). */
+export declare const PERIOD_TARGET_PURGES_COLLECTION = "_period_target_purges";
+/**
+ * Exclusive upper bound for a period's delete-marker purge window (#604).
+ * Markers carry no business date (empty body), only write-time `_ts`, so freeze
+ * purges markers with `_ts < bound`, `bound` being the instant just after the
+ * period's inclusive `endDate`: a date-only `endDate` seals through end-of-day
+ * → next midnight; a full-timestamp `endDate` seals through that instant → +1ms.
+ */
+export declare function periodExclusiveUpperBound(endDate: string): string;

package/dist/with-audit/portability/export-accessible.d.ts

@@ -7,7 +7,7 @@
  * Reuses the existing bundle machinery: the access boundary is the caller's DEK
  * set (operator/client → `keyring.permissions`; owner/admin/viewer → all), so a
  * record outside the caller's keys can never enter the bundle. Re-keying to a
- * new owner reuses `writePod`'s `exportPassphrase` shorthand.
+ * new owner reuses `writePod`'s `exportSecret` shorthand.
  */
 import type { Vault } from '../../kernel/vault.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
@@ -22,16 +22,16 @@ export declare function resolveAccessibleCollections(keyring: UnlockedKeyring, s
 } | undefined, writableOnly?: boolean): string[] | undefined;
 /** Produce a (optionally re-keyed, scoped) `.noydb` bundle — no audit. */
 export declare function buildAccessibleBundle(vault: Vault, collections: string[] | undefined, reKey: {
-    passphrase: string;
+    secret: string;
 } | undefined, compression?: 'auto' | 'brotli' | 'gzip' | 'none'): Promise<Uint8Array>;
 export interface ExportAccessibleOptions {
     /**
      * Re-key the bundle so it is independently openable by a new owner with this
-     * passphrase (the receiving firm / the client themselves). Omit to inherit
+     * secret (the receiving firm / the client themselves). Omit to inherit
      * the source keyring (personal backup).
      */
     readonly reKey?: {
-        readonly passphrase: string;
+        readonly secret: string;
     };
     /** Narrow the export to a subset of the caller's accessible collections. */
     readonly scope?: {

package/dist/with-audit/portability/request-withdrawal.d.ts

@@ -15,7 +15,7 @@
  * Requests live in the reserved `_user_withdrawal_requests` namespace. The
  * record body is plaintext metadata (collection names + disposition + legal
  * basis — none secret in this trust model; the owner sees the data anyway) and
- * carries NO passphrase: the re-key passphrase is supplied by the approver at
+ * carries NO secret: the re-key secret is supplied by the approver at
  * approval time and conveyed to the requester out-of-band, so no secret is
  * stored at rest.
  */
@@ -66,9 +66,9 @@ export declare function listWithdrawalRequests(vault: Vault, opts?: {
     status?: WithdrawalRequestStatus;
 }): Promise<WithdrawalRequest[]>;
 export interface ApproveWithdrawalOptions {
-    /** Re-key the handed-back bundle to a passphrase the requester will use. */
+    /** Re-key the handed-back bundle to a secret the requester will use. */
     readonly reKey?: {
-        readonly passphrase: string;
+        readonly secret: string;
     };
 }
 /**

package/dist/with-audit/portability/withdraw-accessible.d.ts

@@ -29,9 +29,9 @@ export interface FrozenSnapshotRef {
 export interface WithdrawAccessibleOptions {
     /** Legal/contractual basis recorded in the audit (e.g. 'gdpr-art-17'). */
     readonly legalBasis: string;
-    /** Re-key the exported bundle to a new owner passphrase. */
+    /** Re-key the exported bundle to a new owner secret. */
     readonly reKey?: {
-        readonly passphrase: string;
+        readonly secret: string;
     };
     /** Source disposition. Default 'delete'. */
     readonly disposition?: 'delete' | 'freeze';

package/dist/with-audit/sealed-record/strategy.d.ts

@@ -13,7 +13,7 @@
  * @internal
  */
 import type { SealingContext } from '../../kernel/enclave/index.js';
-import type { RecipientSealer } from '../../with-party/team/managed-passphrase.js';
+import type { RecipientSealer } from '../../with-party/team/managed-secret.js';
 export interface SealedRecordStrategy {
     sealRecordToHost(ctx: SealingContext, collection: string, id: string, hostSealer: RecipientSealer, opts: {
         expiresAt: string;

package/dist/with-audit/tiers/index.d.ts

@@ -392,3 +392,4 @@ export declare function demote<T>(ctx: TiersContext<T>, id: string, toTier: numb
 export declare function classifySealedShred<T>(ctx: TiersContext<T>, live: EncryptedEnvelope): Promise<{
     readonly slots: readonly SealedShredSlot[];
 }>;
+export type { SealedShredSlot } from '../../kernel/enclave/index.js';

package/dist/with-cargo/adopt-partition.d.ts

@@ -9,7 +9,7 @@
  */
 import { type EnclaveKey } from '../kernel/enclave/index.js';
 import type { NoydbStore } from '../kernel/types.js';
-import type { SealingKeyProvider } from '../with-party/team/managed-passphrase.js';
+import type { SealingKeyProvider } from '../with-party/team/managed-secret.js';
 import type { ShamirRecoveryProvider } from '../with-party/team/shamir-recovery-provider.js';
 import type { RecoveryEnrollmentInput } from '../with-party/team/rotate-recover.js';
 import type { TransferSealPayload } from '../with-pod/bundle.js';
@@ -35,14 +35,14 @@ export interface CreateOwnerResult {
     readonly vaultName: string;
     readonly userId: string;
 }
-/** Standard-mode owner: recipient supplies the passphrase. */
+/** Standard-mode owner: recipient supplies the secret. */
 export interface CreateOwnerStandardOptions {
     readonly userId: string;
-    readonly passphrase: string;
+    readonly secret: string;
     readonly transferKey: Uint8Array;
 }
 /**
- * Managed-mode owner: the passphrase is minted + sealed under
+ * Managed-mode owner: the secret is minted + sealed under
  * a `SealingKeyProvider` (e.g. an `at-*` OS keychain) so the partition
  * auto-unlocks on the recipient's device. Managed mode mandates a strong
  * (Shamir) recovery profile at creation, which needs the
@@ -50,7 +50,7 @@ export interface CreateOwnerStandardOptions {
  */
 export interface CreateOwnerManagedOptions {
     readonly userId: string;
-    readonly passphraseMode: 'managed';
+    readonly secretMode: 'managed';
     readonly sealingKey: SealingKeyProvider;
     readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>;
     readonly shamirRecovery: ShamirRecoveryProvider;
@@ -61,8 +61,8 @@ export type CreateOwnerOptions = CreateOwnerStandardOptions | CreateOwnerManaged
  * Mint the first owner keyring on an adopted-but-unowned partition,
  * then destroy the transfer seal.
  *
- * Standard mode: the recipient supplies a passphrase. Managed mode: the
- * passphrase is minted + sealed under a `SealingKeyProvider` and a strong
+ * Standard mode: the recipient supplies a secret. Managed mode: the
+ * secret is minted + sealed under a `SealingKeyProvider` and a strong
  * (Shamir) recovery profile is enrolled — orchestrated via the existing
  * `openVaultAndEnrollRecovery` ceremony.
  *